Hi Gary,
> Please review the release candidate and vote.
> This vote will close no sooner than 72 hours from now.
>
> [ ] +1 Release these artifacts
> [ ] +0 OK, but...
> [ ] -0 OK, but really should fix...
> [ ] -1 I oppose this release because...
I performed the following tests:
* I tested the signature and hashes of the ZIP archives,
* I tested the source archive and the reproducibility of binaries with:
mvn clean verify artifact:compare
-Dreference.repo=https://repository.apache.org/content/repositories/orgapachecommons-1676
* I tested 4 simple JLink runtimes: JCL + Log4j Core 2.x, JCL + Log4j
Core 3.x, JCL + `java.logging` and just JCL.
+1 (non binding): everything works correctly with the following remarks:
1. the SPDX artifact is not reproducible,
2. For some strange reason I had to set `TZ=America/New_York` to make
the main JAR reproducible. Either the Moditect or the Maven JAR plugin
are responsible for that.
3. The SHA512 sums in the distribution can not be used with
`sha512sum -c` (they lack the file name).
Piotr
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org
For additional commands, e-mail: dev-h...@commons.apache.org
